The vulnerability arises because ANDRITZ HIPASE-250 exposes data and configuration endpoints without requiring authentication and applies a permissive Cross‑Origin Resource Sharing policy to every response. This flaw allows an attacker who can reach the device over the network to read live process values and the server’s configuration settings. The impact is a breach of confidentiality, potentially revealing sensitive production data and operational details that could aid further attacks or competitive intelligence.

This flaw affects ANDRITZ HIPASE‑250, which was previously known as 250 SCALA, when deployed in its default configuration. The vulnerability applies to any affected version using the default settings; no specific software revision is cited in the advisory.

The CVSS score of 7.5 indicates a high‑severity risk, while the EPSS score of less than 1% suggests that exploitation is rare at present and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, an attacker that can reach the device, such as one on the same industrial network or with compromised credentials on the network, can exploit the flaw simply by issuing HTTP requests to the exposed endpoints. The lack of authentication and overly permissive CORS make the attack trivial once network access is achieved, underscoring the need for immediate remedial action.